Data processing agreement (DPA) under Art. 28 GDPR

§ 1 Subject, term and instructions

(1) The Processor processes personal data on behalf of the Controller in connection with the use of the software “Stitchomat” (main contract).

(2) Processing takes place only on documented instructions of the Controller. Instructions are given in text form or through the configuration of the Software; the latter counts as a documented instruction. Oral instructions must be confirmed in text form without delay.

(3) This agreement runs for the term of the main contract. It ends automatically with it without separate termination.

(4) If the Processor considers an instruction to be unlawful under data protection law, it informs the Controller without delay and may suspend its execution until confirmed.

(5) Data is stored in Germany. Processing in third countries only takes place through the subprocessors listed in Annex 3 and only to the extent described there. Any further transfer to a third country only takes place where there is a legal obligation; in that case the Processor informs the Controller in advance unless the law prohibits this.

§ 2 Nature, purpose and scope of processing

(1) Nature, purpose, categories of data and data subjects are set out in Annex 1.

(2) The Processor does not use the Controller’s data to train AI models.

(3) Data minimisation for AI. Free-text input for a motif wish is sent to a language model that separates the image description from the text to be embroidered. Image models only receive the image description derived from it; names and text to be embroidered are separated beforehand. Contact details and order codes go to no AI model. Names, text and monograms from the name field and logo uploads are processed without AI unless the Controller uses AI clean-up.

(4) No automated individual decision-making within the meaning of Art. 22 GDPR. The AI functions create drafts and filter inadmissible input; they do not decide on claims, contracts or services. Every embroidery file is approved by the Controller before production.

(5) Photos of persons (selfies) are not subject of this agreement. Such processing requires a separate agreement.

§ 3 Rights and obligations of the Controller

(1) The Controller is responsible for the lawfulness of processing and for safeguarding the rights of data subjects (Art. 24 GDPR). It alone assesses whether it may collect the data and provide it to the Processor, and it informs its end customers (Art. 13 GDPR). The Processor provides a template privacy notice for this.

(2) The Controller gives all instructions under § 1(2) and names the persons authorised to do so; in the customer account its administrators are authorised to give instructions. It communicates changes without delay.

(3) The Controller informs the Processor without delay if it detects errors or irregularities in the processing.

(4) The Controller keeps the record of processing activities under Art. 30(1) GDPR for the processing it is responsible for.

§ 4 Technical and organisational measures, confidentiality

(1) The Processor implements the measures described in Annex 2 (Art. 32 GDPR). The measures are subject to technical progress; the Processor may adapt them provided the level of protection is not reduced. Material changes are documented and communicated on request.

(2) The Processor only uses persons for processing who are bound to confidentiality and familiar with the relevant data protection rules. The obligation continues after the end of their activity.

§ 5 Subprocessors

(1) The Controller grants a general authorisation to engage the subprocessors listed in Annex 3.

(2) The current list is published under Subprocessors. The Processor informs the Controller’s administrators in text form at least 30 days in advance of adding or replacing a subprocessor and updates the published list at the same time. The notice names the subprocessor, the purpose, the place of processing and the planned date.

(3) The Controller may object within 14 days of receiving the notice for an important data protection reason. If the service cannot be provided without the subprocessor concerned, both parties may terminate the main contract effective on the planned date.

(4) The Processor binds subprocessors to a level of data protection corresponding to this agreement. For transfers to third countries it ensures appropriate safeguards under Art. 44 et seq. GDPR.

(5) Not subprocessing are ancillary services the Processor uses to conduct its business that are not aimed at processing the Controller’s data – such as telecommunications, postal, transport or maintenance services. The Processor takes appropriate precautions to protect the data here as well. This does not apply to maintenance and remote maintenance services where access to the Controller’s personal data cannot be ruled out; such services are subject to paragraphs 1 to 4.

(6) Liability for subprocessors. If a subprocessor fails to fulfil its data protection obligations, the Processor is liable to the Controller for the performance of that subprocessor’s obligations as for its own actions (Art. 28(4) sentence 2 GDPR). Provisions of the main contract on availability and third-party services leave this liability unaffected.

§ 6 Assistance to the Controller

(1) The Processor assists the Controller with appropriate means in fulfilling data subject rights (Art. 12–23 GDPR) and with data protection impact assessments and consultations of the supervisory authority (Art. 32–36 GDPR). On instruction it finds, exports or deletes orders by order code.

(2) If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without delay and does not answer it itself.

(3) The Processor provides information within seven working days. It corrects or deletes individual records only on documented instruction.

§ 7 Notification of personal data breaches

The Processor notifies the Controller of any personal data breach it becomes aware of without delay, at the latest within 24 hours, and provides the information required for a notification under Art. 33 GDPR. If not all information is available yet, it first reports the known facts and supplements them without delay.

§ 8 Audit rights

(1) The Controller may verify compliance with this agreement. The Processor provides the necessary information, in particular documentation of the measures in Annex 2.

(2) On-site audits are permitted with reasonable notice of at least 14 days during normal business hours, without unreasonably disrupting operations. The Processor may make the audit subject to a confidentiality undertaking and ensure the protection of other customers’ data.

(3) Evidence may also be provided through current attestations, certificates or reports from independent bodies.

§ 9 Deletion and return

(1) During the term, the Processor deletes data according to the periods in Annex 1 or the periods agreed with the Controller.

(2) After the end of the main contract the Controller chooses whether the data still stored is returned or deleted. The Processor keeps it available for export for 30 days. If the Controller makes no choice within this period, the data is deleted unless a statutory retention obligation applies. Backups, where they exist, expire on a rolling basis according to the periods in Annex 2 and are not processed for other purposes until then.

(3) Access logs. The servers’ access logs are exempt from deletion under paragraph 2. They are created with every request and contain the information listed in Annex 1, in particular the requester’s IP address; they contain no design input, files or credentials. The Processor processes them solely to ensure operational security, to detect and investigate attacks and abuse, and for troubleshooting (Art. 32(1) GDPR), and keeps them for 180 days from creation; they are then deleted automatically. They are not processed for any other purpose, in particular not to analyse usage behaviour, measure reach or train AI models.

(4) Deletions are logged without personal content. On request, the Processor confirms deletion in text form. A right of retention to the Controller’s data under Section 273 BGB is excluded.

§ 10 Requests from authorities

(1) If the Processor receives a disclosure, information or seizure request from an authority or court concerning the Controller’s data, it informs the Controller without delay unless legally prohibited.

(2) The Processor points out to the requesting body that the Controller decides on the data, and discloses data only to the extent legally obliged. It examines the lawfulness of the request and exhausts reasonable legal remedies.

(3) The Processor complies with requests from third countries only under the conditions of Art. 48 GDPR.

§ 11 Liability

(1) For damage not based on a breach of data protection obligations, the liability provisions of the main contract apply.

(2) Liability towards data subjects under Art. 82 GDPR remains unaffected; it is neither excluded nor limited by this agreement.

(3) Internal recourse. Internally, the parties bear compensation paid under Art. 82(4) GDPR according to their respective share of responsibility for the damage (Art. 82(5) GDPR). The monetary caps of the main contract do not apply to this claim to the extent it is based on a breach of obligations specifically imposed on the Processor by this agreement or the GDPR, or on acting contrary to a lawful instruction (Art. 82(2) sentence 2 GDPR). The Processor’s liability under this paragraph is limited to EUR 50,000 per incident and EUR 100,000 per contract year; paragraph 2 remains unaffected.

(4) Procedure. If a claim under Art. 82 GDPR is asserted against a party, it informs the other party without delay, gives it the opportunity to comment and coordinates with it before any acknowledgement or settlement. Both parties support each other in defending unfounded claims.

§ 12 Final provisions

(1) In case of conflict between this agreement and the main contract, this agreement takes precedence in data protection matters.

(2) Changes must be in text form.

(3) German law applies. Place of jurisdiction is Frankfurt am Main, where permitted.

Annex 1 – Subject, data, data subjects, retention

Subject: operation of software with which the Controller’s end customers design embroidery motifs and the Controller generates, checks, approves and downloads embroidery files from them.

Duration: term of the main contract plus the periods in § 9.

Data subjects

• End customers of the Controller who design a motif via QR code, link or kiosk
• Employees and agents of the Controller (access to the staff area)
• Persons whose names appear in embroidery orders

Data categories and retention

Special categories under Art. 9 GDPR are not subject of the processing. They may, however, unavoidably appear in free-text fields if end customers provide them on their own initiative. The Controller works towards preventing this.

Annex 2 – Technical and organisational measures

• Physical access control: operation exclusively in data centres of Hetzner Online GmbH in Germany (ISO 27001 certified); no own server room, no physical access by the Processor.
• System access control: staff area only after login, signed session cookie (HttpOnly, Secure, SameSite=Strict, 12 hours), lock-out after repeated failed attempts; without a configured password the area stays closed. Operations access to the cluster only via VPN.
• Data access control: embroidery files, thread lists and the order list only in the staff area; end customers only see preview images of their own drafts via random identifiers. AI drafts only via the stand QR code or a logged-in kiosk device.
• Separation and hardening: own namespace with network policies against other applications in the cluster; containers without root privileges and with a read-only file system (Pod Security “restricted”); write requests only from the own origin.
• Encryption: TLS for all connections (HSTS); metadata (EXIF/GPS) is removed from uploads; uploads only as PNG, JPEG or WebP with size limits.
• Pseudonymisation: IP addresses in application logs and counters only as hash values; application logs contain no wish texts or names.
• Access logging: every request through the ingress component is logged with IP address, time, requested address, status code and browser identifier; headers carrying credentials are discarded. Retention 180 days (§ 9(3)).
• Deletion: hourly automated deletion job according to Annex 1 with a deletion log without personal content.
• Availability: cluster with several nodes in two data centres; data storage on a Hetzner volume. There is currently no backup of design and order data.
• Monitoring: self-hosted error tracking without IP addresses, cookies or request content; daily budget, session and IP limits and an emergency stop for the AI functions.

Added with the introduction of user accounts and the database: personal user accounts with roles instead of a shared team login, tenant separation in database and file storage, downloads via short-lived links after server-side permission checks, and a daily backup of database and designs (raw uploads excluded). The Processor will then update this annex under § 4(1).

Annex 3 – Subprocessors

The list under Subprocessors applies in the version published at conclusion of the contract; changes under § 5.